Elliptic curves with 3-adic Galois representation 
surjective mod 3 but not mod 9 

Noam D. ElkiesQ 

Abstract. Let E be an elliptic curve over Q, and pi : Gal(Q/Q)-^GL2(Z;) 
its i-adic Galois representation. Serre observed that for I > 5 there is no proper 
closed subgroup of SL2(Z;) that maps surjectively onto SL2(Z/ZZ), and concluded 
that if pi is surjective mod I then it is surjective onto GL2(Z;). We show that this 
no longer holds for I = 3 by describing a modular curve ^9 of genus parametriz- 
ing elliptic curves for which P3 is not surjective mod 9 but generically surjective 
mod 3. The curve JEg is defined over Q, and the modular cover 3>g— >X(1) has 
degree 27, so i£g is rational because 27 is odd. We exhibit an explicit rational 
function / 6 Q(a;) of degree 27 that realizes this cover. We show that for every 
x 6 P 1 (Q), other than the two rational solutions of f(x) = 0, the elliptic curves 
with j-invariant f(x) have p$ surjective mod 3 but not mod 9. We determine 
all nonzero integral values of f(x), and exhibit several elliptic curves satisfying 
our condition on p$, of which the simplest are the curves Y 2 — X 3 — 27 X — 42 
and Y 2 + Y = X 3 - 135X - 604 of conductors 1944 = 2 3 3 5 and 6075 = 3 5 5 2 
respectively. 

0. Introduction. Let E be an elliptic curve over Q, and pi : Gal(Q/Q)^GL2(Z/) its 
^-adic Galois representation. Serre observed in 1968 |7J IV, 3.4, Lemma 3] that for I > 5 
there is no proper closed subgroup of SL2(Z/) that maps surjectively onto SL2(Z/^Z), 
and concluded that if pi is surjective mod I then it is surjective onto GL2(Z;). He 
noted IV, 3.4, Exercise 3] that for I = 3 there exists a subgroup G C SL2(Z/9Z) 
such that the restriction to G of the reduction-mod-3 map SL2(Z/9Z)^SL2(Z/3Z) is 
an isomorphism. The preimage of G in SL2(Za) is then a proper closed subgroup that 
maps surjectively to SL2(Z/3Z). This suggests that there could be curves E for which 
G is the image of pz mod 9, making p$ surjective mod 3 but not mod 9. Serre does not 
raise this question explicitly, and it does not seem to have been addressed elsewhere in 
the literature; I thank Grigor Grigorov for drawing my attention to it. In this paper 
we answer the question by showing that there exist infinitely many j '6 Q for which 
an elliptic curve of j-invariant j must have ps surjective mod 3 but not mod 9. The 
simplest examples are j = 4374, j — 419904, and j — —44789760. In general j is the 
value of a rational function f(x) of degree 27 at all but finitely many x £ P 1 (Q). 

Such curves E are parametrized by a modular curve = X(9)/G. The natural cover 
%~g^X(l) has degree 27, and our rational function / arises as the pullback to <3£g of 
the degree- 1 function jonJf(l). It is easy to check from the Riemann-Hurwitz formula 
that ^9 has genus zero. The challenge is to prove that is defined over Q and to 
compute f{x) for some choice of rational coordinate x on JTg. (Once is known to be 
defined over Q, it is automatically isomorphic with P 1 over Q, becoause it supports 
the rational function j of odd degree.) We prove the rationality in section 1, and 
compute x using products of Siegel functions in section 2. Such products are modular 
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units on X(N) with known g-cxpansions; since the cusps of J?Tg are not rational we 
must also find a fractional linear transformation over Q that takes the modular unit to 
a function x defined over Q. In section 3 we discuss elliptic curves E with j-invariants 
obtained by specializing /, and use explicit computation of curves X(9)/H with H C G 
to show that all such curves with x G P 1 (Q) satisfy our condition on p% except for 
those with j = 0. Finally in section 4 we determine the finite set /(P 1 (Q)) n Z, and 
exhibit some specific elliptic curves E whose j-invariants are these integral values. 

1. The group G and the curve 3Kq. The group SL2(Z/3Z) is generated by 

the images mod 3 of the standard generators of SL2 (Z) . These generators of SL2 (Z/3Z) 
satisfy 

S 2 = (ST) 3 = -I, T 3 = I. 

To lift SL 2 (Z/3Z) to a subgroup G of SL 2 (Z/9Z), it is enough to lift S,T to matrices 
mod 9 satisfying the same relations^ A direct search finds 27 such lifts S, T, all equiv- 
alent under conjugation in SL2(Z/9Z). These yield 27 choices of lift of PSL2(Z/3Z) to 
a subgroup G/{±1} of PSL 2 (Z/9Z) = Aut(JT(9)), all conjugate in Aut(X(9)). Hence 
the quotients of X(9) by these subgroups are all equivalent under Aut(X(9)). We 
choose 

and set G = (S,f) C SL 2 (Z/9Z) and 3£ 9 = X(9)/(G/{±1}). 

We can then calculate the genus of by applying the Ricmann-Hurwitz formula 
cither to the quotient map X(9)— >S£§ : using the fact that X(9) has genus 10, or to 
the covering map 3£%— >X (1). In the quotient map, each of the three involutions in G 
has six fixed points, and each of the four 3-element subgroups has three; thus the 
ramification divisor has degree 3-6 + 4- 6 = 42 = 2\G\ + 2(10 — 1), whence has 
genus 0. The covering map has degree 27 and is unramified except above the cusp 
j = 00 and the elliptic points j = 0, j = 1728. We find that these points have 
preimages with multiplicities 9 3 , 3 8 1 3 , and 12 2 1 3 respectively (using m c as a standard 
shorthand for c preimages of multiplicity m) . Hence the ramification divisor has degree 
3-8 + 8- 2 + 12 = 52 = 2(27 — 1), so again we conclude that ^9 has genus 0. 

In particular, each of the cusps of X(9) has trivial stabilizer in G. To explain this, note 
that the stabilizer in PSL2(Z/9Z) of each cusp of X(9) is conjugate to the group of 
matrices {±(q ")}; if G had a nontrivial intersection with this group then G would con- 
tain {±(0 5*)}, contradicting the requirement that the reduction map G— »PSL 2 (Z/3Z) 
be bijective. It follows that %g has 27/9 = 3 cusps. 



2 Warning: This approach to lifting SL2(Z/nZ) works only for n < 5 (including n = 4), where 
(s,t I s 2 = (st) 3 = t n = 1) is a presentation of PSL2(Z^Z). For n > 5 more relations must be 
checked. 
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To obtain a model of 5£§ denned over Q, we must extend G to a group G' C GL2(Z/9Z) 
such that G' > G and the determinant map G'/G^(Z/9Z)* is an isomorphism. For 
the preimages of the squares in (Z/9Z)* we use the invertible multiples of the iden- 
tity (recall that —I is already in G). It remains to lift ±( _ p < j ) ) from GL2(Z/3Z) to 

GL2(Z/9Z), and we calculate that the unique choice that normalizes G is ±(~ J) • To- 
gether with the invertible scalar matrices this yields a unique extension G' satisfying 
our conditions, and thus a unique structure for 3£q as a modular curve over Q. 

In general, even if a curve of genus is known to be defined over Q it need not be 
isomorphic with P 1 (Q). But in our case the curve supports Q-rational divisors of odd 
degree (such as the preimage of the cusp, or indeed the preimage of any rational point 
on X(l)), so ^9 must be isomorphic with P 1 (Q). In the next section we choose an 
isomorphism, and compute j as a rational function of a rational coordinate on i£g. 

While JTg is defined over Q, its three cusps are not rational. More precisely, they 
are conjugate over the cyclic cubic extension K := Q(£ + C -1 ), where ( — e 27 ™/ 9 , a 
primitive 9th root of unity. To sec this, we check that G' contains an element ±(° J) 
for a = ±1 (when 6 = 0) but no other a e (Z/9Z)*. (Since G' contains (l"), it is 
enough to check this for a — A and a = 7, and then we can multiply by the scalar 
matrix a -1 G G' to reduce to the corresponding statement for G.) Thus the subgroup 
of Gal(Q(£) / Q) that fixes the cusp ioo consists of the images of ±1 under the standard 
identification of (Z/9Z)* with Gal(Q(£)/Q). Hence that cusp is defined over K but 
not over Q, and its conjugates under Gal(if/Q) must be the other two cusps of ^9. 

The fact that the cusps of JTg are not rational will make our computation of rational 
functions on ^9 somewhat trickier: we can still expand these functions in powers of q, 
but the coefficients will in general be contained only in K, not in Q, even for a function 
in Q(JT 9 ). 

2. Computing x and f{x). For r in the upper half-plane H, let q — e 27rrr as usual, 
and let q 9 = e 27TtT ' 9 , a local parameter for X(9) and %~ g at the cusp r = ioo, with 
q = <7g. The curve ^(3) has genus zero with rational coordinate 

#3= (j^yf + 3 = % 3 (1 + 5q-7q 2 + 3q 3 + 15 g 4 - 32, 5 + + -•••); 

the curve X(9) is a (Z/3Z) 3 cover of X(3) whose function field is obtained from C(Hs) 
by adjoining cube roots of H — 3, ( 3 H — 3, and (~ 3 H — 3. The group PSL 2 (Z/3Z) acts 
on X(3) by the fractional linear transformations of H that permute {00, 3, 3£ 3 , 3C~ 3 }, 
which are the transformations that preserve j = H 3 (H 3 +216) / (H 3 — 27) 3 . (Recall that 
we set ( = e 2 W9 ; S o 1 and £ ±3 are the cube roots of unity.) To compute ^g, we may 
lift these transformations to elements of G in the group PSL 2 (Z/9Z) of automorphisms 
of ^(9) and look for a rational function x of degree 1 on the quotient i£g = X(9)/G. 
We could try to find x using our above description of the function field of X(9) as a 
(Z/3Z) 3 extension of C(iJ 3 ), but this seemed like an unpleasant project. Instead we 
use modular units on X(9), that is, modular functions whose divisors are supported 
on the cusps. 
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For integers a, b we have a function s a ,b on TC defined by 

oo 

s(a,b) = - ( b q a 9 ) JJ(1 - C b 9 9 9 " +a )(l - C b ql n ' a ), 

n=l 

where a = (a 2 /9 + a — 9/6)/2 = 18S2(a/9). This is a modular unit, namely the "Siegel 
function" of [H p. 29] with parameters (a/9,6/9), multiplied by a power of — £ that is 
irrelevant for our purpose. Taking TV = 9 in [4J p. 68, Thm. 4.1], we see that a product 
F = JT s(a r , 6 r ) m '' of such functions is a modular function on X(9) if and only if the 
(a r ,b r ) and m r satisfy the "quadratic relations" 

m r a 2 = m r 6 2 = m r a r b r = mod 9. 

r r r 

Note that this condition depends only on the (a r ,b r ) mod 9, and is invariant under 
changing (a r ,b r ) to (—a r ,—b r ) for some r; Indeed s(— a, — 6) is a scalar multiple of 
s(a, b), as is s(a' , b') if (a', 6') = (a, 6) mod 9. 

The pairs {(a, b), (—a, —6)} G (Z/9Z) 2 with at least one of a, 6 not divisible by 3 
correspond bijectively with the cusps of X(9): the cusps are orbits of T(9) acting on 
P 1 (Q), and if gcd(a, b) = gcd(a', 6') = 1 for some integers a, 6, a', b' then a/b and a'/b' 
are in the same orbit if and only if (a 1 , b 1 ) = (a, b) or (—a, —6) mod 9. This labeling 
is consistent with the action of PSL2(Z/9Z) on cusps, and dual to its action on the 
modular units s(a,b) (up to /x 18 factors). We choose one of the three orbits of the 
action of G/{±1} on the cusps of X(9), and take (a r , b r ) corresponding to the twelve 
cusps in the orbit. We check that these satisfy the quadratic relations with m r = 1, so 
the product F of the twelve functions S(a r , b r ) is a modular function on X(9) whose 
divisor is invariant under G. 

There is then a homomorphism x '■ G^C* such that F(g(r)) = x{9)F{ T ) f° r all 5 G G 
and t G T~L. We claim that \ is trivial. Indeed, if it were nontrivial we could take for g 
a 3-cycle in G, and for r a preimage of a fixed point on X(9) of g, and conclude that 
r is a zero or pole of F, which is impossible because r is not a cusp. Therefore x is 
trivial as claimed, whence F descends to a function on ^9 whose only poles or zeros 
are at the cusps. 

We find that F has a simple pole at one cusp, a simple zero at another, and neither 
zero nor pole at the third. In particular, F is a function of degree 1 on Choosing 
the orbit of (a, b) = (1, 0), corresponding to the cusp ioo, we find that F has a pole at 
that cusp, and calculate the g-expansion 

F = Qg 1 - 1 + c 4 q 9 + c x ql + (c 2 + 2)g| + c 4 ^ 

where c m := £ m + C~"\ a un it m K. The q-expansions of the products correspond- 
ing to the other two orbits then let us recognize those products as fractional linear 
transformations of F, namely l/(F — c 2 + 1) and (1 — c 2 )/F. 

It follows that F takes the values and 1 — c 2 on the other two cusps of 3£$. Therefore 
j, considered as a rational function of F, must have its poles at F — 0, 1 — C2,oo, 
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each with multiplicity 9. Indeed we compute that F 9 (F — c 2 + l) 9 j is a polynomial 
of degree 27 in F to the accuracy allowed by our q-expansions (which extend far 
enough beyond the constant term of that polynomial to provide a sanity check on our 
computations). 

It remains to hnd a fractional linear transformation with coefficients in K that, when 
applied to F, yields a coordinate x on <5£g such that j G Q(a;). Thus x must map the 
three cusps to a Gal(if/Q) orbit in K. We may choose any ordered orbit, and then 
x is determined uniquely, because PGL 2 acts simply 3-transitively on P 1 . (The order 
must be consistent with the Galois action on the cusps.) We then apply a PGL 2 (Q) 
transformation so that the map %g—>X(l) is represented by a rational function with 
small coefficients. This leads us to 

-dF + 1 - c 2 
F- Cl +3(l-c 2 ) 

= -ci + (2c 2 + c 4 )q 9 + 3(1 - ci)g$ + (6 - 7c x + c 2 )g| + (15 - 16ci + 7c 2 )g| 
when j = /(x) with 

3 7 (x 2 - l) 3 (x 6 + 3x 5 + 6x 4 + x 3 - 3x 2 + 12a; + 16) 3 (2x 3 + 3x 2 - 3a; - 5) 



m = - 



1728 



(x 3 - 3a; - l) 9 
3 3 yL 2 (x).B 2 (x)(2x 3 -3x 2 +4) 



(x 3 - 3x - l) 9 

where A(x), B(x) are the sextic polynomials 

A{x) = x 6 + 6x 5 + 4x 3 + 12x 2 - 18x - 23, 

B{x) = 7x 6 + 24x 5 + 18x 4 - 26x 3 - 33x 2 + 18x + 28. 



3. The elliptic curves parametrized by i£g. Now let E/Q be an elliptic curve with 
j-invariant f(x) for some x G P 1 (Q). Assume that its 3-adic Galois representation p^ 
is surjective mod 3. Then its image mod 9 is (a conjugate of) the proper subgroup 
G' of GL 2 (Z/9Z), because this image is contained in G and its determinant maps 
surjectively to Zg. In particular, p 3 is surjective mod 3 but not mod 9, as desired. 

We claim that the mod-3 condition on p 3 is satisfied by except at x = ±1, the points 
at which f(x) = 0, the j-invariant of an elliptic curve with complex multiplication. 

For any elliptic curve E/Q, the representation p 3 is surjective mod 3 if and only if 
the intersection of its image in PGL 2 (Z/3Z) with PSL 2 (Z/3Z) is contained in the 
4-element normal subgroup or in a cyclic subgroup of order 3. In the former case, 
the j-invariant je of E is a cube, and this necessary condition is also sufficient unless 
3e = 0. If f(x) ^ then f(x) is a cube if and only if 3(2x 3 + 3x 2 - 3x - 5) = z 3 for 
some zeQ. This curve of genus 1 has no rational points due to a 3-adic obstruction: 
we have 

2x 3 + 3x 2 - 3x - 5 = 3(x + l) 3 - (x + 2) 3 , 

so the 3-adic valuation of 3(2x 3 + 3x 2 — 3x — 5) is never divisible by 3. Thus /(x) 
is never a nonzero cube. The latter case holds if and only if E admits a rational 
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3-isogeny. Such x are parametrized by a curve JT g ' = iKg/(T), the quotient of X(9) 
by a 3-cycle in G. This curve has genus 3, so there are only finitely many such x by 
Mordell-Faltings. For a general curve of genus 3 it is not known how to provably list 
all the rational points. But here we are lucky: we can give a rational map of degree 3 
from SC§ to the elliptic curve Y 2 + Y = X 3 , which is known to have rank zero. Pulling 
back each of this curve's three rational points to 3£§ then yields a set of Q-rational 
points that must contain all the Q-rational ones. To complete the proof of our claim 
we shall observe that there are only two Q-rational points, one for each of a; = ±1. 

A simple model for j£g is 

3z| = z 1 (z 3 + 3z 2 -6z 1 + l), (1) 

and the map to Y 2 + Y = X 3 can be given by 

{X :Y ■.l) = (z 1 (z 1 + l)z 2 :3z 2 1 :z 3 ). (2) 

The rational points on are (0, 0) and the point at infinity. The equation |T]) for ^ 
shows that this curve has an automorphism a of order 3 that fixes Z\ and multiplies 
Z2 by a cube root of unity. This automorphism arises from the element 3T — 2 = ( Q ^ 
of PSL2(Z/9Z), which commutes with T and thus descends from Aut(X(9)) to an 
automorphism of 2£§. The quotient of 3£§ by (a) is the zi-line, which covers the 
j-line X(l) with degree 36 and the curve Ao(3) with degree 9. The latter map can be 
realized by the rational function 27 ((z 3 + 3zf — 6z 1 + l)/(z 3 — 6z 2 + 3zj + 1))' . 

We next outline the computation of the model (fTJ) and the map We begin with 
the modular units 

S (l,0)s(4,6)s(4,3), s(4,0) S (7,6)s(7,3), s(7, 0)s(l, 6)s(l, 3). (3) 

The first of these corresponds to the orbit of the cusp ioo under the 3-cycle T, and the 
others are obtained by multiplying {(1, 0), (4, 6), (4, 3)} by 4 and 7 mod 9. We calculate 
that these products do not satisfy the quadratic relations, but the quotient of any two 
of them does, giving a rational function of degree 3 on Using the g-expansions we 
find that the three functions in ((3]) are linearly dependent, and thus that their pairwise 
quotients are all related by fractional linear transformations over K . As we did for x, 
we find two linear combinations of the functions in (|3|) whose quotient is a degree-3 
function on 3£§ defined over Q. We call this function 

y = -c 2 + (c 4 -c 2 + 3)q g + (3c 4 - 6c 7 + 9)^ + (10c 4 - 22c 7 + 27)gjj 

and use the g-expansions to find the coefficients of a polynomial identity P(x, y) = 
of bidegree (3,4) in (x,y). 

This is a model for 3£q inP^P 1 , but it is not smooth. We find that it has three double 
points, at x = y = — ci, — C2, — c 4 . Thus the holomorphic differentials on 3C§ are the 
forms Q(x, y) dx/ P y for Q in the 3-dimensional space of polynomials of bidegree (1, 2) 
that vanish at the three singularities. We interpret these as modular cuspforms of 
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weight 2 on 3£§ by writing qdx/dq in place of dx, and find a basis for the space of 
such cuspforms: 

<p x = c 4 q - 3q 3 - 2c 2 q 4 - Cl q 7 + 6q 12 + 5c 2 q 13 + 4c l9 16 - 7c 4 q 19 + 3q 21 • ■ • , 

tp 2 = q + {c A - ci)(? 2 + q 4 + (2c 2 + c±)q 5 + 2q 7 + (c 2 + c 4 )g 8 - 3q 10 ■■■ , 

<p 3 = (c 4 -<a)q- iq 2 + (ca - ci)q 4 + 3q 5 + (2d - 2c A )q 7 + 3q 8 + (3c 2 - 3c 4 )g 10 

The affine model ([TJ is then obtained by taking (zi : z 2 : 1) = (y 2 + <Pi : tp 3 : 2(p 2 — ip 1 ). 
The map ([2{ was obtained by integrating the CM form (p 1 ; it can also be seen in flj 
by writing the cubic factor as (z\ + l) 3 — 9z±. 

4. Numerical examples. Besides /(±1) = 0, there are seven other integers obtained 
by evaluating f(x) at points of P 1 (Q) of small height. For each of those, we list x, 
f(x), and one of the elliptic curves E of j-invariant f(x) and minimal conductor N: 



X 


3 = fix) 


E 


N 


1/0 


4374 


[0,0,0,-27,-42] 


2 3 3 5 


-2 


419904 


[0,0,0,-162,792] 


2 8 3 5 





-44789760 


[0,0,1,-135,-604] 


3 5 5 2 


-1/2 


15786448344 


[0,0,0,-5427,153882] 


2 5 3 5 


2 


24992518538304 


[0,0,0,-201042,34695912] 


2 8 3 5 17 2 


-3/2 


-92515041526500 


[0,0,0,-1126035,459913278] 


2 3 3 5 19 2 


-1/3 


-70043919611288518656 


[0, 0, 1, -1127379978, -14569799990728] 


3 5 97 2 101 2 



The smallest conductor here is 1944 = 2 3 3 5 , still too large to appear in Cremona's 
published tables [2] of curves of conductor < 1000. But Cremona has pursued his 
computations up to 10 5 and beyond (see [3] for the status as of mid-2006), enough 
to find our first curve as well as those of conductors 6075 = 3 5 5 2 , 7776 = 2 5 3 5 , and 
62208 = 2 8 3 5 . Curves with j = 4374, j = 419904, and j = 15786448344 already 
appeared in the tables of elliptic curves with good reduction away from 2 and 3, 
compiled in 1966 by F.B. Coghlan and published as "Table 4" in [TJ p. 123]: see rows 
52, 84, and 86 of "Table 4a" [TJ p.125], and [U p.75] for the attribution to Coghlan. 

A search up to height 256 found no more integral values of f(x). Since / has three 
distinct poles, there can be only finitely many x for which f(x) £ Z. We claim that in 
fact we have found them all. Suppose x — m/n in lowest terms. The resultant of the 
numerator and denominator of f(x) is 3 486 , so when we write f(m/n) as the quotient 
of homogeneous polynomials in m, n the denominator (m 3 — 3mn 2 — n 3 ) 9 must be 
±3 A for some A. Thus m 3 — 3mn 2 — n 3 = ±1 or ±3, because the only (m, n) £ Z 2 
for which 9 | m 3 — 3mn 2 — n 3 are those for which 3|m and 3|n. The only cases of 
m 3 — 3mn 2 — n 3 = ±3 are x = 1, —2, —1/2, because these are the only rational points 
on the elliptic curve x 3 — 3x — 1 = 3z 3 (isogenous with the cubic Fermat curve). For 
m 3 — 3mn 2 — n 3 = ±1 one must work harder because the elliptic curve x 3 — 3x — 1 = z 3 
has rank 1. Fortunately this work was already done by Ljunggren, who proved in 1942 
that the Thue equation m 3 — 3mn 2 — n 3 = 1 has only the six solutions (1, 0), (0, —1), 
(— 1, 1), (2, 1), (1, —3), (—3, 2), corresponding to values of x already listed above. (See 
§2], cited by Nagell [6] who also notes the connection between X 3 + Y 3 = Z 3 
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and m 3 — 3mn 2 — n 3 = 3.) The solutions of m 3 — 3mn 2 — n 3 = — 1 are obtained 
from these six by changing each (m,n) to (— m, — n), which yields the same values of 
x = m/n. Thus our list contains all the nonzero integral j-invariants of elliptic curves 
parametrized by JT 9 . 
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